183 matches found
CVE-2026-8445
justhtml (a Python HTML parsing library) versions <= 1.11.0 are vulnerable to a sanitizer bypass via its to_markdown() method. The root cause is insufficient escaping of HTML-significant characters (angle brackets ) in text nodes during Markdown conversion. While a small set of Markdown metach...
CVE-2026-7808
justhtml (Python HTML parsing library) before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active content such as [removed] or to survive sanitization, potentially leading to cross-site scripting . The issues primarily affect advanced usage rather than the default Just...
CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...
CVE-2026-8445 justhtml before 1.12.0 Sanitizer Bypass via Markdown
justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...
CVE-2026-8445 justhtml before 1.12.0 Sanitizer Bypass via Markdown
justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...
CVE-2026-77088
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...
any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-77088 via justhtml (>=0.35.0, <=1.14.0)
justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-77088 Source advisory: MEND:CVE-2026-77088...
CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...
CVE-2026-77088
justhtml versions 0.9.0 through 1.21.0 are affected by a cross-site scripting (XSS) vulnerability in the to_markdown() function. The root cause is that inline code spans fail to treat blank lines as block boundaries. An attacker can inject blank lines into or element text to break the inline sp...
CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...
EUVD-2026-64657
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...
CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...
CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...
any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +3 more potentially affected by CVE-2026-74793 via justhtml (>=0.35.0, <=1.23.0)
justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.2.0, =0.1.0, =0.1.5 - projectify-app 2026.7.26 Source cves: CVE-2026-74793 Source advisory: MEND:CVE-2026-74793...
any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-6827 via justhtml (>=0.35.0, <=1.14.0)
justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-6827 Source advisory: MEND:CVE-2026-6827...
EUVD-2026-64655
justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...
CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...
CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...
EUVD-2026-64656
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...
CVE-2026-74793
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...